farhan nadim pial fnpial

hi, i'm daniel. i'm a 15-year-old with some programming experience and i do a little bug hunting in my free time. here's the insane story of how I found a single bug that affected over half of all Fortune 500 companies:

say hello to zendesk

If you've spent some time online, you’ve probably come across Zendesk.

Zendesk is a customer service tool used by some of the world’s top companies. It’s easy to set up: you link it to your company’s support email (like [email protected]), and Zendesk starts managing incoming emails and creating tickets. You can handle these tickets yourself or have a support team do it for you. Zendesk is a billion-dollar company, trusted by big names like Cloudflare.

Personally, I’ve always found it surprising that these massive companies, worth billions, rely on third-party tools like Zendesk instead of building their own in-house ticketing systems.

your weakest link

Another Another CSP by @terjanq

Background

This year I created a copycat challenge of another-csp from DiceCTF Quals 2024. It was only solved by 1 team, DiceGang. Although the challenge looked almost identical, the solutions should be strictly different.

The intended solution of the original challenge was to leak one bit of information per admin visit based on crashing the browser renderer process with malicious CSS. (The below snippet was crashing the browser, but currently it's fixed)

Demo site

https://is-xss-possible.pages.dev/

Problem

(Please note that this problem might be unresolvable, as it's a real-world one.)

I encountered the following JavaScript in the real world (this is the simplified version):

const obj = {};

Description

This details how to capture voice text and rings associated with iridium satellite rebroadcasts of the Aircraft Communications Addressing and Report System (ACARS)

Prerequisites:

Start installation in home directory preferred
```
cd ~
```
Install the following repos preferably from source or using apt in home directory or /usr/scr/:

How to understand Blast 101

OP Stack

How OP Stack works

OP Stack Documentation
Optimism Bedrock Specs, relevant parts are:
- Introduction
Overview

The Top Hacker Methodologies & Tools Notes

By Chase. ** *

Nuclei Templates

Concrete5 CMS : Identification, Mass Hunting, Nuclei Template Writing & Reporting

My Methodology

	Allow: CONNECT
	Allow: GET
	Allow: HEAD
	Allow: POST
	Allow: TRACE
	Client-IP: 0
	Client-IP: 0177.0000.0000.0001
	Client-IP: 0x7F000001
	Client-IP: 10.0.0.0
	Client-IP: 10.0.0.1

	/**
	* This DLL is designed for use in conjunction with the Ruler tool for
	* security testing related to the CVE-2024-21378 vulnerability,
	* specifically targeting MS Outlook.
	*
	* It can be used with the following command line syntax:
	* ruler [auth-params] form add-com [attack-params] --dll ./test.dll
	* Ruler repository: https://github.com/NetSPI/ruler/tree/com-forms (com-forms branch).
	*
	* After being loaded into MS Outlook, it sends the PC's hostname and

	// ==UserScript==
	// @name PostMessage Tracker
	// @namespace Violentmonkey Scripts
	// @match :///*
	// @version 1.0
	// @author Ounissi zakaria (https://twitter.com/zakaria_ounissi)
	// @description Each time an event listener is added for `message` it adds a menu command to tha message handler.
	// @grant GM.registerMenuCommand
	// @run-at document-start
	// ==/UserScript==

	'''
	IDA plugin to display the calls and strings referenced by a function as hints.

	Installation: put this file in your %IDADIR%/plugins/ directory.
	Author: Willi Ballenthin <[email protected]>
	Licence: Apache 2.0
	'''
	import idc
	import idaapi
	import idautils